Add tag-triggered release pipeline (release.yml + publish.yml)

[chrishayuk]

Summary

Adds an automated release pipeline, modeled on the one in chuk-artifacts:

• release.yml — triggered by pushing a v*.*.* tag (or manual workflow_dispatch with a tag input). Verifies the tag matches pyproject.toml's version, generates a changelog from git log since the previous tag, and creates a GitHub Release.
• publish.yml — triggered when a release is published. Gates on the full test suite (ci.yml, now reusable via workflow_call), builds the package with uv build, and publishes to PyPI using trusted publishing (OIDC) — no stored API token.
• ci.yml — added workflow_call: as a trigger so publish.yml can reuse the exact same test suite as a gate instead of duplicating test logic.

Required one-time setup

Trusted publishing needs to be configured on PyPI before the first tagged release: on the mcp-cli project's Publishing settings page, add IBM/mcp-cli as a trusted publisher for workflow publish.yml, environment pypi. Until that's done, build/test will still succeed but the final PyPI upload step will fail.

Release flow going forward

1. Bump version in pyproject.toml, commit to main.
2. git tag vX.Y.Z && git push origin vX.Y.Z
3. release.yml creates the GitHub Release automatically.
4. Publishing that release triggers publish.yml, which tests, builds, and publishes to PyPI.

Test plan

• All three workflow YAML files parse cleanly
• First real tag push (after PyPI trusted-publisher setup) to confirm end-to-end